Privacy policy
What personal data this site processes, why, and what you can ask of us.
SKELETON. Replace every bracketed value before going live. This is a starting structure, not legal advice.
Who is responsible
[Company name], [address], [company number]. Questions about this notice: [privacy@example.com].
What we process, and why
Account data — your email address and password hash, so you can sign in. Legal basis: performance of a contract (GDPR art. 6(1)(b)). Kept until you delete your account.
Session and security cookies — session, signed_in, guest_id,
locale, consent, and the short-lived cookies used while signing in,
verifying an email address or resetting a password. Legal basis: legitimate
interest in running a secure service (art. 6(1)(f)), and for the strictly
necessary ones the ePrivacy art. 5(3) exemption. See the cookie
policy.
Measurement — only if you agree to it. See the cookie policy for the vendors and how to change your mind at any time. Legal basis: consent (art. 6(1)(a)).
Error diagnostics — when something breaks, we record the error. Session replay, which records what you did before the error, runs only with your consent.
Who else sees it
[List every processor: hosting, email delivery, payment processing, and the measurement vendors listed in the cookie policy.] Some process data outside the EEA under the European Commission's standard contractual clauses.
Your rights
Access, rectification, erasure, restriction, portability, and objection. You may withdraw consent at any time — through Cookie preferences in the page footer, or on the cookie policy page — without affecting processing that already happened. You may complain to your supervisory authority; in the Czech Republic that is the Úřad pro ochranu osobních údajů.
Changes
We will update this page and, where the change is material, ask again.